3 ms·

I'm not saying it's not a good idea, but that system's gonna be really tough on the software industry. Consider what would happen when a famous third-party API

by acbabis 10y ago

I'm not saying it's not a good idea, but that system's gonna be really tough on the software industry. Consider what would happen when a famous third-party API has security flaw. Most third-party libraries' licenses have an "as-is" clause and even mature third-party software has exploits sometimes (e.g. Java applets). If you wanted to use a library in a project, you would have to - a) read the entire thing to see if you can find any bugs that the devs missed, or - b) roll your own solution which will probably have even more bugs, or - c) find an equivalent library that has a paid version without the "as-is" clause. Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business.

noir_lord 10y ago
I own one of those small shops so I'm not unsympathetic but few other industries get away with 'as-is' disclaimers, Can you imagine it in the automotive,aeronautical, transport etc? The present system is a pass the parcel of blame with no one taking any responsibility, tonnes of shit, insecure systems written and designed poorly. Eventually something will give.
- jonnathanson 10y ago
  "Can you imagine it in the automotive,aeronautical, transport etc?" This. This is the most important point I've read so far. The key word here is "imagine." I think even we, as an industry, don't quite grok the degree to which software truly has eaten the world -- and the degree to which it now is every bit as important, as life-or-death, as things like cars, airplane travel, or even medicine. We hold these goods to certain standards because we deem them extremely critical -- too important to be left to the de facto standards set by the operation of a wild-west market. It's about time the notion of standards-free software shocked people as much as the notion of standards-free engineering in any other systemically critical industry. I'd prefer self-established standards set by the industry to government-imposed standards set by lay bureaucrats. But the latter is coming eventually if the former never does.
sedachv 10y ago
> Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business. Surgeons are not liable for, for example, hip replacement implants from a decade ago that are now known to have problems, but they would be responsible if they continued using the implants after they were recalled. They also purchase malpractice insurance. How is this any different than following security advisories and purchasing liability insurance?

by acbabis 10y ago

noir_lord 10y ago

I own one of those small shops so I'm not unsympathetic but few other industries get away with 'as-is' disclaimers, Can you imagine it in the automotive,aeronautical, transport etc? The present system is a pass the parcel of blame with no one taking any responsibility, tonnes of shit, insecure systems written and designed poorly. Eventually something will give.

jonnathanson 10y ago
"Can you imagine it in the automotive,aeronautical, transport etc?" This. This is the most important point I've read so far. The key word here is "imagine." I think even we, as an industry, don't quite grok the degree to which software truly has eaten the world -- and the degree to which it now is every bit as important, as life-or-death, as things like cars, airplane travel, or even medicine. We hold these goods to certain standards because we deem them extremely critical -- too important to be left to the de facto standards set by the operation of a wild-west market. It's about time the notion of standards-free software shocked people as much as the notion of standards-free engineering in any other systemically critical industry. I'd prefer self-established standards set by the industry to government-imposed standards set by lay bureaucrats. But the latter is coming eventually if the former never does.

sedachv 10y ago

> Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business. Surgeons are not liable for, for example, hip replacement implants from a decade ago that are now known to have problems, but they would be responsible if they continued using the implants after they were recalled. They also purchase malpractice insurance. How is this any different than following security advisories and purchasing liability insurance?